|
 |
a02333 |
diff -up openssl-1.0.1e/crypto/evp/e_aes.c.truncated openssl-1.0.1e/crypto/evp/e_aes.c
|
|
|
a02333 |
--- openssl-1.0.1e/crypto/evp/e_aes.c.truncated 2016-11-09 15:31:47.000000000 +0100
|
|
|
a02333 |
+++ openssl-1.0.1e/crypto/evp/e_aes.c 2017-01-30 13:29:46.700570930 +0100
|
|
|
a02333 |
@@ -796,11 +796,17 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *
|
|
|
a02333 |
gctx->tls_aad_len = arg;
|
|
|
a02333 |
{
|
|
|
a02333 |
unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1];
|
|
|
a02333 |
+ if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
|
|
|
a02333 |
+ return 0;
|
|
|
a02333 |
/* Correct length for explicit IV */
|
|
|
a02333 |
len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
|
|
|
a02333 |
/* If decrypting correct for tag too */
|
|
|
a02333 |
if (!c->encrypt)
|
|
|
a02333 |
+ {
|
|
|
a02333 |
+ if (len < EVP_GCM_TLS_TAG_LEN)
|
|
|
a02333 |
+ return 0;
|
|
|
a02333 |
len -= EVP_GCM_TLS_TAG_LEN;
|
|
|
a02333 |
+ }
|
|
|
a02333 |
c->buf[arg-2] = len>>8;
|
|
|
a02333 |
c->buf[arg-1] = len & 0xff;
|
|
|
a02333 |
}
|
|
|
a02333 |
diff -up openssl-1.0.1e/crypto/evp/e_rc4_hmac_md5.c.truncated openssl-1.0.1e/crypto/evp/e_rc4_hmac_md5.c
|
|
|
a02333 |
--- openssl-1.0.1e/crypto/evp/e_rc4_hmac_md5.c.truncated 2013-02-11 16:26:04.000000000 +0100
|
|
|
a02333 |
+++ openssl-1.0.1e/crypto/evp/e_rc4_hmac_md5.c 2017-01-30 10:33:12.954714810 +0100
|
|
|
a02333 |
@@ -257,6 +257,8 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_
|
|
|
a02333 |
|
|
|
a02333 |
if (!ctx->encrypt)
|
|
|
a02333 |
{
|
|
|
a02333 |
+ if (len < MD5_DIGEST_LENGTH)
|
|
|
a02333 |
+ return -1;
|
|
|
a02333 |
len -= MD5_DIGEST_LENGTH;
|
|
|
a02333 |
p[arg-2] = len>>8;
|
|
|
a02333 |
p[arg-1] = len;
|
|
|
a02333 |
diff -up openssl-1.0.1e/ssl/t1_enc.c.truncated openssl-1.0.1e/ssl/t1_enc.c
|
|
|
a02333 |
--- openssl-1.0.1e/ssl/t1_enc.c.truncated 2017-01-09 16:42:47.000000000 +0100
|
|
|
a02333 |
+++ openssl-1.0.1e/ssl/t1_enc.c 2017-01-30 10:37:32.836053160 +0100
|
|
|
a02333 |
@@ -805,6 +805,8 @@ int tls1_enc(SSL *s, int send)
|
|
|
a02333 |
buf[11]=rec->length>>8;
|
|
|
a02333 |
buf[12]=rec->length&0xff;
|
|
|
a02333 |
pad=EVP_CIPHER_CTX_ctrl(ds,EVP_CTRL_AEAD_TLS1_AAD,13,buf);
|
|
|
a02333 |
+ if (pad <= 0)
|
|
|
a02333 |
+ return -1;
|
|
|
a02333 |
if (send)
|
|
|
a02333 |
{
|
|
|
a02333 |
l+=pad;
|